To assist companies in complying with its final rules implementing the executive order on Preventing Access to Americans’ Bulk Sensitive Personal Data and United States Government-Related Data by Countries of Concern, the DOJ recently released three new guidance documents. The final rules, which the National Security Division of the DOJ refers to as the Data Security Program (DSP), took effect in substantial part on April 8, 2025. With commentary from Edward McNicholas, a partner at Ropes & Gray, this two-part article series highlights the key elements of the guidance. This second installment distills guidance on DSP requirements around the data compliance program, recordkeeping, reporting, licenses and advisory opinions. Part one covered the enforcement grace period, definitions of bulk data and covered persons, and prohibited transactions. See “Examining DOJ’s Final Rules on Access to Government and Sensitive U.S. Personal Data” (Jan. 29, 2025).